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^NRC  has  been  charged  by  Congress  with  the  responsibility  for  provision  and 
maintenance  of  safeguards  against  theft  and  sabotage  of  licensed  nuclear 
materials  and  facilities.  In  the  discharge  of  this  mandate,  the  Commission 
directed  the  Division  of  Safeguards  to  undertake  two  studies:  one  aimed  at  a 
systematic  determination  of  the  characteristics  of  potential  adversaries  to 
nuclear  programs  and  the  second  aimed  at  a more  detailed  examination  of  the 
potential  Insider  adversary.  ) 

^The  first  study,  entitled  Generic  Adversary  Characteristics  (GAC),  was  Intended 
as  an  Initial  NRC  effort  at  threat  definition.  It  entails  an  analysis  of 
characteristics  associated  with  subnational  conventional  crimes  and  terrorist 
actions  that  could  be  analogous  to  potential  nuclear  events.  \ Notce  I said 
"analogous"--s1nce  adversary  actions  directed  against  nucleanfacll  Itles  have 
been  so  few,  we  relied  on  an  analog  methodology  under  the  assumption  that  a 
study  of  serious  non-nuclear  crimes  can  provide  insights  into  the 
characteristics  of  potential  nuclear  adversaries.  V ^ 

The  data  sources  for  the  study  consisted  of  over  650  articles,  studies,  books, 
NRC  reports  and  memoranda,  as  well  as  Interviews  with  Federal  experts,  crimino- 
logists, psychiatrists  and  social  scientists. 


The  study  addressed  six  generic  adversary  groups:  terrorists,  organized/ 

sophisticated  criminals,  extremist  protestors,  disoriented  persons,  disgruntled 
employees,  and  miscellaneous  criminals.  They  constituted  the  perceived  range 
of  possible  threats  of  concern  to  us  at  the  time.  Data  were  drawn  from  Inci- 
dents wherein  laws  were  broken  or  in  which  criminal  Intent  was  obvious.  We 
Integrated  the  results  of  the  data  analysis  Into  an  adversary  characteristic 
matrix  like  the  one  you  received.  Each  column  of  the  matrix  represents  a 
composite  profile  of  one  of  the  six  generic  adversary  types  based  on  observed 
actions  and  behavior. 


Please  recognize  that  these  composites  do  not  represent  the  upper  or  lower 
limits  of  adversary  characteristics.  Rather,  they  are  the  characteristics 
commonly  found  in  the  criminal  acts  we  reviewed.  As  such,  they  can  be 
considered  representative  of  the  characteristics  that  might  be  exhibited  by 
such  groups  should  they  target  nuclear  activities  in  the  near  future. 

I don't  have  the  time  today  to  discuss  the  matrix  In  detail,  but  I would  like 
to  mention  briefly  some  of  the  study's  conclusions.  First,  one  of  the  least 
likely  methods  of  attack  Is  an  overt  armed  assault,  Even  highly  dedicated 
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I terrorists  usually  choose  to  approach  their  targets  without  resorting  to  arms, 

| preferring  to  display  firepower  only  once  inside  and  in  control  of  a facility. 

!•  Second,  physical  danger  appears  to  have  some  deterrent  effect  on  all  adversaries 

| except  the  psychotic.  Most  adversaries  proved  to  be  risk  avolders.  Third, 

I organized  and  professional  criminals  often  recruit  insiders  to  provide  them 

| with  some  form  of  assistance,  and  disoriented  persons,  disgruntled  employees, 

1 « and  white-collar  criminals  usually  operate  as  Insiders. 

I Finally,  pegging  defense  capabilities  to  some  predetermined  number  of  postu- 

lated  adversaries  might  be  an  Inappropriate  tack  for  security  planners  since 
| behavioral  characteristics  such  as  motivation  and  dedication  appear  to 

jj:'  Influence  adversary  success  at  least  as  much  as  group  size. 

I \ 

\ 

I ^The  Insider  Ttudy  addresses  the  t,wo  types  of  insider  crime  that  are  the  primary 

!■  concern  of  nuclear  safeguards--theft  and  sabotage— and  focuses  on  the  Insider 

| adversary,  one  whose  authorized  access  to  a facility  or  activity  may  be 

I exploited  by  him  or  others  In  the  commission  of  a crime. 

[>  The  three  objectives  of  the  study  are  shown  here.  Data  used  In  fulfilling 

these  objectives  were  derived  primarily  from  case  histories  of  Insider  crime, 
but  also  from  expert  opinion  and  from  non-NRC  studies . kJoday,  I will  concen- 
trate on  objectives  one,  two  and  the  prevention  portlonVf  three. 

As  with  the  GAC,  we  relied  on  an  analog  approach.  Our  criterion  for  deter- 
mining which  of  the  cases  we  gathered  were  the  best  analogs  was  the  degree  to 
which  the  safeguards  systems  In  place  at  the  time  of  the  crime  approximate  the 
safeguards  required  of  nuclear  licensees. 

From  the  cases  that  met  our  criteria,  we  extracted  data  on  a variety  of  charac- 
teristics of  the  Insider  adversary  and  grouped  them  Into  the  four  categories 
shown  on  this  vu-graph:  position-related  (e.g.,  screening  and  length  of 

service);  behavioral  (such  as  motivation);  resource  (e.g.,  group  size  and 
equipment);  and  operational  (such  as  tactics). 

The  major  sources  of  data  for  the  study  fall  Into  the  two  categories  shown-- 
U.S.  Government  agencies  and  private  Industry.  Examples  In  the  first  category 
Include  the  FBI,  Department  of  Energy,  and  Bureau  of  Engraving  and  Printing. 

The  second  category  Includes  money  handlers,  such  as  banks  and  casinos;  material 
handlers,  such  as  drug  firms  and  chemical  manufacurers;  and  money  or  material 
transporters,  such  as  explosives  carriers  and  armored  transport  companies. 

In  presenting  the  results  of  our  characteristics  analysis,  I will  be  addressing 
the  typical  Insider  thief,  the  typical  insider  saboteur  and  a comparison 
between  the  lone  thief  and  the  theft  conspiracy.  First,  the  thief.  The 
typical  Insider  thief  acted  alone  In  70%  of  the  theft  cases,  whereas  10% 

Involved  two  Insiders  and  20%  three  or  more  Insiders.  Typically,  and  not 
surprisingly,  the  Insider  thief  was  motivated  by  greed,  Indebtedness  or 
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financial  Inducement.  These  money-related  motivations  accounted  for  74%  of 
all  the  motivations  identified.  The  next  most  frequently  occurring  motivations 
were  drug  use/abuse  (6%)  and  personal  loyalty  (5%).  The  largest  percentage  of 
Insider  thefts  (38%)  occurred  during  the  6-10  year  period  of  employment,  27% 

In  the  3-5  year  time  period,  and  19%  during  the  first  two  years  of  employment. 
Approximately  80%  of  the  Insider  thieves  planned  their  crimes  well  or  mode- 
rately well.  By  the  way,  all  of  these  figures  are  based  on  112  cases  of 
Insider  theft  involving  237  insiders. 

Next  we  looked  at  the  role  of  the  Insider,  defining  role  as  either  overt  or 
covert.  By  "overt"  we  mean  that  the  insider  was  able  to  perpetrate  the  crime 
In  the  presence  of  others  without  arousing  suspicion.  "Covert"  means  that  the 
Insider  was  unable  to  carry  out  the  crime  In  the  presence  of  others  without 
arousing  suspicion.  Approximately  two-thirds  of  the  Insider  thieves  relied  on 
covert  activity  to  commit  their  crimes.  Lastly,  in  87%  of  the  cases,  equipment 
necessary  to  commit  the  crime  was  available  at  the  site  of  the  theft.  Although 
not  shown  on  the  vu-graph,  we  also  gathered  data  on  the  Insiders'  level  of  pre- 
employment screening.  Over  40%  of  the  Insider  thieves  had  received  poor 
screening  or  none  at  all,  with  only  11%  receiving  high-level  screening  and  just 
a handful  undergoing  psychological  evaluation. 

Before  looking  at  the  typical  insider  saboteur,  I would  like  to  emphasize  that 
our  sabotage  analysis  Is  based  on  a small  data  base,  and  thus  our  findings 
represent  a limited  characterization.  First,  85%  of  the  analogous  sabotage 
cases  were  committed  by  a single  Insider.  Although  no  one  motivation  dominated 
the  Insider  saboteur,  the  combined  motivations  of  psychological  problems, 
dlsgruntlement  and  revenge  accounted  for  54%  of  the  Identified  motivations. 
Approximately  two-thirds  of  Insider  saboteurs  committed  their  crimes  In  the 
first  two  years  of  employment,  and  they  tended  to  plan  less  well  for  their 
crimes  than  did  the  thieves.  In  fact,  about  one-third  of  their  actions  could 
be  characterized  as  spur  of  the  moment  acts  executed  against  targets  of 
opportunity.  The  Insider  saboteur,  like  the  thief,  relied  on  covert  action  88% 
of  the  time  and  most  frequently  used  equipment  that  was  readily  available  at 
the  site  of  the  crime.  As  with  the  thief,  psychologcal  evaluations  were 
rarely  administered  and  over  a third  had  received  poor  screening  or  none  at 
all. 

The  next  three  vu-graphs  depict  a comparison  between  the  single  thief  and 
thieves  who  operate  In  conspiracy. 

For  nearly  every  case  In  the  data  base,  we  Identified  the  one  or  more  generic 
weaknesses  In  the  security  system  that  rendered  It  vulnerable  to  the  Insider 
adversary.  The  five  vulnerabilities  shown  here  are  the  ones  that  most 
frequently  accounted  for  the  success  of  the  crimes  we  analyzed  and  were  most 
often  cited  by  government  and  industry  experts.  Let  me  say  a few  words  about 
the  fourth  entry.  Personnel  security  deficiencies  Include  Inadequate  pre- 
employment screening,  insufficient  behavioral  observation,  and  poor  management/ 
employee  relations.  These  three  deficiencies  contributed  to  the  success  of 
about  15%  of  the  theft  cases  and  about  70%  of  the  sabotage  cases. 
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Inadequate  screening  was  judged  a vulnerability  when  It  was  discovered  after 
the  fact  that  the  insider  had  a criminal  record  that  made  him  a poor  risk  or 
that  he  had  a history  of  emotional  Instability  that  cast  doubt  on  his  ability 
to  function  reliably.  Insufficient  behavioral  observation  was  applied  when 
the  malevolent  insider  suffered  from  a psychological  or  personal  problem 
(Including  drug  abuse)  that  should  have  warned  an  alert  co-worker  or  supervisor 
to  potential  difficulty.  Poor  management/ employee  relations  refers  to  situa- 
tions in  which  management  failed  to  provide  a mechanism  for  airing  and  resolving 
employee  grievances  or  proper  recognition  and  Incentives  for  Its  employees. 

In  assessing  prevention  method  effectiveness,  we  looked  at  a number  of  different 
techniques  now  In  use  In  Industry  and  government  and  derived  some  implications 
about  the  prevention  strategies  shown.  For  today's  symposium,  I will  discuss 
only  the  first  three  methods  listed. 

As  for  screening,  our  data  suggest  that  It  Is  an  effective  theft  control 
strategy,  and  most  of  the  experts  we  Interviewed  strongly  advocated  Its  use. 

Its  effectivesness  arises  from  several  factors.  First,  It’s  generally  accepted 
that  a potential  adversary  may  be  deterred  from  even  applying  for  a job  at  a 
facility  that  employs  screening.  Second,  It  conveys  to  prospective  employees, 
as  well  as  to  those  who  are  eventually  hired,  that  the  organization  Is  concerned 
with  Insuring  a high  degree  of  Integrity  among  Its  workforce.  And  third,  good 
screening  correlates  with  reduced  conspiracy  formation.  Of  a 1 the  Insider 
thieves  in  our  data  base  who  underwent  "good"  screening  (l.e.,  screening  based 
on  a full-field  background  Investigation  or  Its  equivalent),  about  60%  acted 
alone  with  40%  acting  In  conspiracy  with  other  Insiders.  This  table  also 
suggests  that  screening  must  be  "good"  to  make  a difference  because  for  any 
level  of  screening  less  than  "good,"  the  results  are  nearly  the  same:  more 
conspiracy  formation.  (The  total  number  of  Insiders  represented  by  this  table 
Is  169.) 

With  respect  to  government  clearances,  we  found  the  following.  A clearance 
cannot  be  expected  to  provide  full  assurance  of  future  trustworthiness  because 
any  number  of  factors  can  Impair  employee  stability  and  reliability  after 
hire.  It  can,  however,  reduce  the  likelihood  of  Infiltration  by  criminal  or 
terrorist  elements  and  lessen  the  chances  that  a facility  will  hire  persons 
who  misrepresent  their  Identities  or  backgrounds  or  persons  with  histories  of 
relevant  criminality  or  emotional  Instability. 

Behavioral  observation  appears  to  pick  up  where  screening  leaves  off  by 
providing  a post-employment  means  of  recognizing  and  dealing  with  Instability 
or  aberrant  behavior  In  employees.  By  so  doing,  behavioral  observation  can 
Increase  employee  reliability  after  hire,  but  for  such  a program  to  be  effec- 
tive, three  elements  are  necessary.  First,  employees'  baseline  stable  behavior 
should  be  identified  at  the  time  of  hire.  Second,  supervisory  personnel  must 
be  properly  trained  to  recognize  aberrant  behavior.  And  third,  criteria  for 
determining  unreliability  must  be  unambiguous  and  applied  equitably. 
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Less  data  was  available  to  us  on  the  subject  of  psychological  evaluations 
because  many  cf  the  industries  we  contacted  do  not  employ  this  technique  due 
to  privacy  act  considerations.  However,  the  technique  Is  widely  used  In 
police  departments  and  the  Intelligence  community.  Generally,  we  concluded 
that  psychological  assessments  can  be  an  effective  adjunct  to  screening  and 
behavioral  observation  If  they  are  evaluated  by  professionals,  but  that  great 
care  must  be  taken  to  prevent  their  misuse  and  mitigate  their  Intimidating 
Impact  on  personnel.  Psychological  evaluations  may  be  especially  Important  In 
preventing  sabotage,  which  was  often  motivated  by  psychological  problems. 

Since  the  Insider  Study  was  completed  last  summer,  the  Commission  has  taken 
action  with  respect  to  the  pre- employment  screening  Issue.  In  November,  NRC 
Issued  a final  rule  requiring  individuals  who  have  access  to  or  control  over 
strategic  quantities  of  special  nuclear  material  to  be  cleared  for  such  access 
through  an  NRC-admlnlstered  personnel  security  program.  Affected  Individuals 
will  undergo  government  background  Investigations  concomitant  with  their  level 
of  access  at  the  expense  of  the  licensee. 

More  recently,  the  NRC  Staff  Is  preparing  for  Commission  review  a rule  that 
will  govern  access  to  non-weapons-grade  nuclear  material  at  power  reactors. 

This  program  would  be  administered  by  reactor  licensees  themselves,  not  by 
NRC.  As  currently  envisioned,  and  I emphasize  that  this  rule  Is  still  In  the 
draft  stage,  the  program  will  consist  of  three  components.  First,  a background 
Investigation,  perhaps  with  FBI  criminal  record  checks  Initiated  by  the 
licensees.  Second,’  psychological  assessment,  consisting  of  two  written 
personality  tests,  one  geared  toward  "abnormal"  behavior  patterns  and  one 
toward  the  "normal"  adult  population,  and  a clinical  Interview  for  Individuals 
whose  test  results  are  questionable  or  Indicate  abnormal  personality  traits. 

And  third,  a post-employment  behavioral  observation  program  to  detect  psycho- 
logical changes  that  may  be  manifested  as  behavioral  changes  in  job  performance, 
competence  or  judgment  capabilities.  As  for  the  psychological  tests,  the  NRC 
has  determined  the  MMPI  and  the  16PF  to  be  acceptable  Instruments  for  use  In 
this  program.  Should  a licensee  wish  to  use  other  Inventories,  he  would  have 
to  establish  that  they  meet  a number  of  standards,  Including  high  test-retest 
reliability  and  statistically  validated  scores.  Both  the  tests  and  the  Inter- 
view should  be  based  on  the  criteria  shown  here,  which  are  measures  of 
behavioral  unreliability  that  have  been  shown  to  be  relevant  to  the  nuclear 
work  setting. 
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